US7062566B2 - System and method for using virtual local area network tags with a virtual private network - Google Patents

Abstract

An exemplary system and method for using a network access system, such as a virtual private network (VPN), are provided. A user device may have a user session with a home agent. Additionally, an initiating security gateway may be in communication with the home agent, and a terminating security gateway may be in communication with the initiating security gateway via a tunnel (e.g., Internet Protocol in Internet Protocol (IP-in-IP) or Internet Protocol security (IPsec) tunnel). Further, a virtual local area network (VLAN) tag associated with the user session may map to a selector operable in a security policy database. The selector may be used to find a security policy defining an IPsec procedure, and the security policy may be applied to the tunnel. Also, the initiating security gateway may also include a Quality of Service (QoS) module that determines QoS markings for a packet traveling along the tunnel.

Description

FIELD OF INVENTION

This invention relates to network access systems. More specifically, it relates to a system and method for accessing a virtual private network utilizing virtual local area network tags.

BACKGROUND OF INVENTION

Network access systems are becoming increasingly important in modern society. People from around the world may now utilize networks such as the Internet to remotely exchange data, information, and ideas. Further, network access systems may be important to companies and businesses worldwide. Many corporations have corporate local area networks (LANs) that employees and clients may remotely access. Additionally, network access systems are often utilized in electronic commerce, such as during Internet transactions, credit card transactions, and Automated Teller Machine (ATM) withdrawals.

Virtual private networks (VPNs) are emerging as an important type of network access system. VPNs may enable users to remotely connect to private LANs via public networks (e.g., the Internet). Before VPNs, large-scale private wide area networks (WANs) were often utilized for remote connections to a LAN, though such networks were often costly and required a complicated network topology. VPNs may provide the advantage of extending the network connectivity of LANs beyond their physical limits while reducing cost and simplifying network topology.

Since a VPN may use a public connection to transmit private data, a mechanism for securing data transmitted across such a network may be beneficial. In recent years, the Internet Protocol Security suite (IPsec) has emerged as an important standard for securing data transferred across a VPN. IPsec can utilize a number of encryption technologies (e.g., Diffie-Helman key exchange, public key cryptography) and authentication technologies (e.g., digital certificates) for securing packet-switched data. An IPsec header may contain an authentication header that helps ensure the integrity of transmitted data, and an encapsulated security payload (ESP) for securing transmitted data.

Furthermore, VPNs may utilize Quality of Service (QoS) to enable network service providers to offer differentiated levels of service to different users. For example, network service providers may use QoS to set a maximum latency, minimum bandwidth, and other such parameters for data transmitted across a VPN for a particular user. Furthermore, network service providers may charge a rate proportional to the QoS level (e.g., a lower rate for a basic service, and a higher rate for a premium service). A Type of Service (ToS) byte within a header of an IP packet may be utilized for specifying QoS. Furthermore, a variety of known protocols (e.g., Resource Reservation Setup Protocol (RSVP)) may be used to implement QoS in VPNs.

Despite these advantages, however, current VPNs that utilize IPsec and/or QoS may face a number of drawbacks. First, prior art systems, such as those utilizing RSVP, are typically not scalable. Furthermore, prior art VPNs using IPsec and QoS may not effectively load balance transmitted data, causing widespread delays and inefficient network usage. Additionally, prior art VPNs may not enable users to customize IPsec policy for different user domains and/or user sessions. Thus, all users may be offered the same level of security regardless of their individual security needs.

Accordingly, it is desirable to have a system and method for accessing a VPN that overcomes the above deficiencies associated with the prior art by utilizing virtual local area network (VLAN) tags.

SUMMARY

A system, device, and method for utilizing VLAN tags with a network access system, such as a VPN, are provided. An exemplary network access system may include a home agent in communication with a user device via a user session. Furthermore, an initiating security gateway may be in communication with the home agent. In addition, a terminating security gateway may be in communication with the initiating security gateway via a tunnel. Further, a VLAN tag associated with the user session may map to a selector operable in a security policy database.

In another aspect of the present embodiment, a method for transmitting a packet via an initiating security gateway may include receiving a packet including a virtual local area network tag and mapping the virtual local area network tag to a selector. Further, the method may include mapping the selector to a security policy stored within a security policy database. In addition, the method may include performing an IPsec procedure based on the security policy, and transmitting the packet to the terminating security gateway across a tunnel.

In yet another aspect of the present embodiment, a network system is provided. The network system may include a home agent in communication with a user device via a user session, and an access server that authenticates the user device and provides a virtual local area network tag for the user session to the home agent. Additionally, the network system may include an initiating security gateway that receives a packet including the virtual local area network tag from the home agent. The initiating security gateway may also include a selector table mapping the virtual local area network tag to a selector. Additionally, the network system may include a security policy database that maps the selector to at least one security policy defining an Internet Protocol security procedure, and the Internet Protocol security procedure may be applied to the packet. Furthermore, the network system may also include a receiving network having a terminating security gateway that receives the packet from the initiating security gateway via a tunnel.

In another aspect of the present embodiment, an initiating security gateway may include a selector module having a filtering mechanism for identifying a virtual local area network tag within a packet. Additionally, the selector module may also include a selector table for mapping the virtual local area network tag to a selector. The initiating security gateway may also include a security policy database for mapping the selector to an Internet Protocol security policy. Furthermore, the initiating security gateway may also include an Internet Protocol Security module for applying the Internet Protocol security policy to the packet while sending the packet to a terminating security gateway.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 shows a block diagram overview of an exemplary embodiment of a virtual private network (VPN);

FIG. 2 shows a more detailed block diagram of an exemplary initiating security gateway of the VPN ofFIG. 1;

FIG. 3 shows a more detailed block diagram of connections between an exemplary initiating security gateway and terminating security gateway of the VPN ofFIG. 1;

FIG. 4 shows a more detailed block diagram of exemplary intermediate components within the VPN ofFIG. 1;

FIG. 5 shows a more detailed block diagram of exemplary network domains within the VPN ofFIG. 1;

FIG. 6 shows an exemplary selector table stored within the initiating security gateway ofFIG. 2 mapping virtual local area network (VLAN) tags to terminating security gateway addresses;

FIG. 7 shows an exemplary method of transmitting data from an initiating security gateway to a terminating security gateway of the VPN ofFIG. 1 using the table ofFIG. 6;

FIG. 8 shows an exemplary selector table stored within the initiating security gateway ofFIG. 2 mapping VLAN tags to network domains within the VPN; and

FIG. 9 shows an exemplary method of transmitting data from an initiating security gateway to a terminating security gateway of the VPN ofFIG. 1 using the table ofFIG. 8.

DETAILED DESCRIPTION

I. Exemplary Network Access System

In an exemplary network access system (e.g., VPN), a user device (e.g., computer, mobile phone) may establish a user session with a receiving network (e.g., corporate LAN, Internet). The user session may pass through a network backbone (e.g., Internet Service Provider (ISP)) having an initiating security gateway. Further, the user session may utilize a tunnel between the initiating security gateway and a terminating security gateway within the receiving network. IPsec procedures may be performed on packets transmitted along the tunnel during the user session.

A. Exemplary Use of Security Associations and IPsec

Before applying IPsec procedures to packets, a security association (SA) may be established for the user session. An SA may define authentication and encryption keys to be used by IPsec, as well as key lifetimes and key replacement procedures.

An SA may be uniquely identified by a security protocol identifier, an IP destination address, and a security parameter index (SPI). The security protocol identifier may identify the type of protocol(s) used by IPsec and may include an authentication header (AH) and/or encapsulated security payload (ESP). The SPI may be a random number (e.g., 32-bit value) that is communicated between the initiating and terminating security gateways. For more information on mechanisms for creating an SA, one can refer to Request for Comments (RFC) 2408, “Internet Security Association and Key Management Protocol (ISAKMP)”, and RFC 2409, “The Internet Key Exchange (IKE)”, respectively, the contents of which are incorporated in their entirety herein by reference.

After an SA has been established, packets utilizing IPsec may be transmitted along the secure user session. AHs may be used with packets to help ensure the integrity of the transmitted data (e.g., to certify that a packet has not been tampered with). Additionally, or alternatively, ESPs may be used for encrypting and securing a packet.

In addition, IPsec may be used in a transport mode, where packet data (but not the IP header) is encrypted. Alternatively, IPsec may be used in a tunnel mode, where the entire packet including the header is encrypted. A packet using IPsec may include a region called a selector for determining what part of the packet to encrypt or authenticate. When sending the packet from an initiating security gateway to the receiving network, an attempt may be made to match the selector specified within the packet to a set of selectors that correspond to IPsec policies and are stored within a security policy database (SPD). If a matching selector is found within the SPD, then its corresponding IPsec policy may be applied to the packet. For more information on IPsec, one can refer to RFC 2401, “Security Architecture for the Internet Protocol”, the contents of which are incorporated in its entirety herein by reference.

B. Assigning VLAN Tags to Exemplary User Sessions

A virtual local area network (VLAN) may be a network of devices that are on different physical LAN segments but act as if they are connected to the same wire. VLAN tags may be headers within a frame that are used for identifying the VLAN which the device sending the frame belongs to. For more information on VLANs and VLAN tags, one can refer to Institute for Electrical and Electronics Engineers (IEEE) 802.1q, the contents of which are incorporated in their entirety herein by reference.

In the present embodiment, a VLAN tag may be assigned to a new user session created between a user device and the receiving network. Packets subsequently sent by the user device that utilize the user session may include the assigned VLAN tag. When an initiating security gateway within the network backbone receives a packet from the user device, it may extract the VLAN tag from the packet. The current IPsec protocol generally does not allow the use of VLAN tags as selectors within an SPD. However, the VLAN tag may be provided to a selector table in order to find a corresponding selector (e.g., IP address or network domain name), and the selector may be provided to the SPD to obtain an IPsec policy. The selector and/or VLAN tag may also be used to obtain QoS markings that are subsequently applied to the packet.

After an IPsec policy has been obtained from the SPD, the initiating security gateway may perform IPsec procedures (e.g., creating an AH, ESP, IPsec tunnel) on the packet, and transmit the packet via a tunnel (e.g., IP-in-IP or IPsec tunnel) to a terminating security gateway within the receiving network. The terminating security gateway may then perform a reverse IPsec procedure on the packet, which may include decrypting and authenticating the packet based on the SPI, destination address, and security protocol identifier (e.g., AH or ESP).

Additionally, a second SPD within the terminating security gateway may then be searched for a value that matches an identification parameter specified within the packet (e.g., domain name or IP address for the user device). If no value matching the identification parameter is found, the packet may be dropped. If a matching value is found, the packet may be forwarded to a final destination as specified by its destination address.

For packets sent from the network to the user device utilizing the user session, IPsec procedures may be performed by the terminating security gateway, and a tunnel (e.g., IP-in-IP or IPsec tunnel) may be created to the initiating security gateway. A reverse IPsec procedure may then be performed within the initiating security gateway, and the packet may then be forwarded to the user device.

The present embodiments may include a number of advantages. VLAN tags may be used in the network access system for providing differentiated IPsec and/or QoS capabilities for packets sent along the tunnel during the user sessions. Additionally, the VLAN tags may enable load balancing of packet-switched data within the network access system. Further, the VLAN tags may provide greater flexibility to changes in the topology of the network access system.

II. Exemplary VPN

Turning now to the drawings,FIG. 1 is a block diagram overview of anexemplary VPN100, though any remotely accessible network or network access system may be used in alternate embodiments. TheVPN100 includes a network backbone120 having ahome agent130 in communication with an initiatingsecurity gateway140. One ormore user devices102,104,106 may be in communication with thehome agent130 via aforeign agent110. Additionally, one ormore user devices108 may be in direct communication with thehome agent130. Furthermore, anaccess server150 may be in communication with thehome agent130, and astorage unit160 may be connected to theaccess server150. The initiatingsecurity gateway140 may also communicate with a terminatingsecurity gateway180 within a receiving network170 (e.g., LAN). In the present embodiment, each of theuser devices102–108 engages in a single user session “A–D”, respectively, with the terminatingsecurity gateway180, though multiple concurrent user sessions for a user device are also possible. For more information on network access systems and VPNs, one can refer to the commonly owned U.S. Pat. No. 6,151,628 and RFC 2764, “A Framework for IP Based Virtual Private Networks”, the contents of which are incorporated in their entirety herein by reference.

A. Exemplary Communication Mechanisms and User Devices

A variety of communication mechanisms may be used with theuser devices102–108. For example, theuser devices102–108 may utilize a dial-up (e.g., modem) connection mechanism for user sessions with thehome agent130. A variety of alternate connection mechanisms, including wireless, Ethernet, DSL, and cable connection mechanisms, may also be. utilized. Furthermore, any number of tunneling mechanisms (e.g., IPsec,Layer 2 Tunneling Protocol (L2TP), Point-to-Point Tunneling Protocol (PPTP)) may also be utilized for these connections.

The connection mechanisms between other components within theVPN100 are preferably Ethernet connections upon which Transmission Control Protocol/Internet Protocol (TCP/IP) and/or Universal Datagram Protocol (UDP)/IP packets may be sent. Further, in an exemplary embodiment, the connection between thesecurity gateways140,180 may be an IP-in-IP or IPsec tunnel, as will be described later. It should be understood that any other connection known in the art that enables communication between network devices may also be utilized in the present embodiment.

Theuser devices102–108 may include any device capable of connecting to thereceiving network170. In the present embodiment, theuser device102 may be a Personal Digital Assistant (PDA), theuser device104 may be a desktop computer, theuser device106 may be a laptop computer utilizing a wireless link, and theuser device108 may be a mobile phone. It should be understood that a variety of other user devices (e.g., videophones, facsimile machines, printers) may also be used with the present embodiment. Furthermore, although four (4) user devices are shown in the present embodiment, any number of different user devices may be utilized in theVPN100, and these user devices may form part of a LAN.

Theforeign agent110 may enable theuser devices102,104,106 to access thehome agent130 from a remote location. For example, theuser devices102,104,106 may use theforeign agent110 for their user sessions A–C if they are in a region not serviced by thehome agent130. Theforeign agent110 may then forward these user sessions A–C through thehome agent130. In a present embodiment, theforeign agent110 may be a Packet Data Serving Node (PDSN), but any known device having such functionality may alternatively be utilized (e.g., IP Routers, Wireless LAN Access Nodes, InterWorking Units (IWU)).

Additionally, it should be noted that theuser devices102,104,106,108, theforeign agent110, and/or thehome agent130 may communicate via any type of wireline (e.g., Ethernet) or wireless communication technology (e.g., Code-Division Multiple Access 2000 (CDMA2000), Global System for Mobile Communications (GSM), General Packet Radio Service (GPRS), Universal Mobile Telecommunications System (UMTS), 3G, WEEE 802.11, etc.). To illustrate, in an exemplary embodiment, theuser device102 may use antennas, packet control functions (PCFs), base transceiver stations (BTSs), base station controllers (BSCs), and/or mobile switching centers (MSCs) for wirelessly communicating with the foreign agent110 (e.g., PDSN) via CDMA2000 wireless technology.

B. Exemplary Network Backbone

The network backbone120 preferably enables theuser devices102–108 to communicate with the receivingnetwork170. In the present embodiment, the network backbone120 may include an Internet Service Provider (ISP). ISPs and network backbones are well known in the art, and a variety of different commercial ISPs are in existence today, such as AOL-Time Warner, Inc. (New York, N.Y.) and United Online, Inc. (Westlake Village, Calif.). In the present embodiment, the network backbone120 may be a connection point of theVPN100, through which most components directly or indirectly communicate. It should be understood that the above recitation of commercial network backbones is meant to illustrate, not limit, the spirit and scope of the present embodiment.

Thehome agent130 may be a software or hardware entity within a remote access server (RAS) that theuser devices102–108 remotely access in order to communicate with the receivingnetwork170. Additionally, thehome agent130 may be in communication with theaccess server150, and include a timeout mechanism (not shown) in order to timeout a connection to theaccess server150 if it is not responsive. In the present embodiment, thehome agent130 may be installed at a central office (CO) of a telephone company. Further, thehome agent130 may be capable of connecting and disconnecting thousands of user sessions from devices such asuser device108 and/or theforeign agent110. Anexemplary home agent130 for use in the present embodiment may be a software program running on the Total Control Enterprise Network Hub incorporating an integral general purpose computing platform, e.g., the HiPerAr™ card, both of which are commercially available from the present assignee, 3COM Corporation. This computing platform card may allow thehome agent130 to run a commercially available stand-alone operating system, such as a standard operating system or a custom operating system designed for theexemplary VPN100.

Additionally, thehome agent130 may utilize other remote access software products, such as RADIUS (Remote Authentication Dial In User Service) or DIAMETER software. These protocols may be utilized during communication with theaccess server150. Further, previously described connection mechanisms may also utilize the RADIUS protocol, which is described in RFC 2865, “Remote Authentication Dial In User Service (RADIUS)”, the contents of which are incorporated in its entirety herein by reference. It should be understood that a number of other commercially available or known home agents and connection protocols may also be utilized with the present embodiment.

The initiatingsecurity gateway140 may be any type of gateway device capable of creating a connection (e.g., tunnel) with the receivingnetwork170. The initiatingsecurity gateway140 may also be capable of adding QoS markings and performing IPsec procedures on a packet. As shown inFIG. 2, an exemplary embodiment of an initiatingsecurity gateway140 may include aselector module142,SPD144,QoS module146, andIPsec module148. Theseexemplary components142–148 will be described in more detail shortly.

C. Exemplary Access Server and Storage Unit

Turning back toFIG. 1, theaccess server150 may be any type of server or computing device that performs authentication and access authorization foruser devices102–108 connecting to thereceiving network170. Consistent with the RADIUS protocol, theaccess server150 may receive an access-request packet from thenetwork device110, and may respond with an access-accept packet or an access-reject packet (packets not shown). The format of access-request, access-accept, and access-reject packets is described within RFC 2865.

Theaccess server150 may use a variety of different mechanisms to authenticate theuser devices102–108. One method of authorization includes telephone number or International Mobile Subscriber Identifier (IMSI) authentication, where theaccess server150 may validate the telephone number of theuser device102–108 that dials in to thehome agent130. Thus, connection requests fromuser devices102–108 with telephone numbers outside the coverage of the network backbone120 may be immediately rejected, forwarded to another network backbone (not shown), or forwarded to another access server.

Additionally, or alternatively, theaccess server150 may utilize a username/password authentication mechanism, where theuser devices102–108 may submit a username and password that are subsequently analyzed by theaccess server150. If theaccess server150 determines that the username and password are not valid, the requested connection may be rejected with an access-reject packet. If the username and password are valid, theaccess server150 may enable thecorresponding user device102–108 to access thereceiving network170 through an access-accept packet. If theaccess server150 is unavailable or unable to process the username and password that it has received, it may ask thehome agent130 to try a connection with another access server. Alternatively, other technologies may also be utilized for authenticating a user, such as face recognition, signature recognition, retina recognition, and DNA analysis. It should be understood that multiple access servers may be utilized in alternate embodiments and that some access servers, while operating independently, may operate on a single computing device or be integrated within a single housing.

Thestorage unit160 may be a relational database, or any other mechanism known in the art for storing data. Alternatively, an SRAM, DRAM, buffer, magnetic hard disk drive, or optical memory may be used as astorage unit160 in the present exemplary embodiment. Thestorage unit160 preferably stores and matches usernames and passwords, as well as other data (e.g., phone numbers) that may be used for identification and authentication of theuser devices102–108. Thus, theaccess server150 may be in communication with and read data from thestorage unit160 when validating auser device102–108. Additionally, when a new user device is added to the list ofuser devices102–108 that are authorized to access thereceiving network170, theaccess server150 may record the new identification and authorization information (e.g., username, password, phone number, etc.) in thestorage unit160. Alternatively, this new data may be written to thestorage unit160 by other machines or input devices, such as a computer or user keypad (not shown). Additionally, it should be understood that identification and authentication information foruser devices102–108 may be split among different storage areas, or that different storage areas may store redundant data.

Furthermore, theaccess server150 and/orstorage unit160 may assign a VLAN tag to the new user session during authorization. Thestorage unit160 may include a table mapping VLAN tags to domain names and/or terminating security gateways within the receivingnetwork170. Thus, the VLAN tag may be assigned to the new user session depending on the domain and/or terminating security gateway it will pass through within the receivingnetwork170 en route to its destination. To illustrate, in an exemplary scenario, a new user session may be created for theuser device106 after it is authenticated and authorized to access thereceiving network170 by theaccess server150. Theaccess server150 may then provide theuser device106 with a VLAN tag associated with a terminatingsecurity gateway180 that is en route to the final destination of the user session. The VLAN tag may then be saved within a mobility binding record (MBR) associated with the new user session within any number of different locations within theVPN100, such as within theuser device106 and/orhome agent130. The MBR may also include a variety of other types of information, such as the address of theforeign agent110, location and IP address of theuser device106, type of tunneling scheme used between theuser device106 and theforeign agent110, IP address of the initiatingsecurity gateway140, and lifetime of the MBR.

Continuing with the exemplary scenario, the VLAN tag associated with the new user session may be included in packets sent from theuser device106 to the initiatingsecurity gateway140. In an exemplary embodiment, thehome agent130 may add the VLAN tags to the packets, although other elements within the VPN100 (e.g.,user device106, foreign agent110) may additionally or alternatively add the VLAN tags. As will be described later, the VLAN tags within the packets may be mapped to a selector table within the initiatingsecurity gateway140 to find a corresponding selector. The selector may then be used to determine security policies and/or QoS markings for the packets.

D. Exemplary Receiving Network and Terminating Security Gateway

In the present embodiment, the receivingnetwork170 may be a corporate LAN that is accessible from the network backbone120. Of course, other types of networks (e.g., WANs or Asynchronous Transfer Mode (ATM) networks) may additionally or alternatively be utilized.

The terminatingsecurity gateway180 within the receivingnetwork170 may be similar to the initiatingsecurity gateway140. In the present embodiment, the terminatingsecurity gateway180 may include an SPD, IPsec module, and QoS module (components not shown). Preferably, the SPD within the terminatingsecurity gateway180 is statically configured to match theSPD144 within the initiatingsecurity gateway140, but dynamic configuration schemes and differences between the SPDs are possible. Further, the terminatingsecurity gateway180 may also include a selector module similar to theselector module142, though this is not utilized in the present embodiment.

When the terminatingsecurity gateway180 receives a packet from the initiatingsecurity gateway140, it may perform a reverse IPsec procedure on the packet. The reverse IPsec procedure may include terminating the tunnel (e.g., IP-in-IP or IPsec) for the packet, decrypting the encapsulated security payload and checking the authentication header for the integrity of the packet. After the reverse IPsec procedure has been performed, the packet may be forwarded to its final destination depending on its destination IP address.

III. Exemplary Initiating Security Gateway

Turning now toFIG. 2, an exemplary embodiment of the initiatingsecurity gateway140 is shown in more detail. As described previously, the initiatingsecurity gateway140 may include theselector module142,SPD144,QoS module146, andIPsec module148. More or fewer components may be used for the initiatingsecurity gateway140 in alternate embodiments, or various components may be combined. For example, in an alternate embodiment, theSPD144 may be part of theselector module142 or may be external to the initiatingsecurity gateway140. Further, any of thecomponents142–148 may be software and/or hardware based, depending on their desired functionality.

A. Exemplary Selector Module

Theselector module142 may include a filtering mechanism for identifying VLAN tags within packets. In the present embodiment, theselector module142 may use the filtering mechanism to read and/or extract VLAN tags from packets sent from theuser devices102–108 to the initiatingsecurity gateway140. The VLAN tags may be stored within any portion (e.g., MAC header) of the packets and may take any value, such as between 1 and 4095. Furthermore, theselector module142 may include a selector table that maps VLAN tags to selectors. These selectors may be subsequently used to find security policies within theSPD144. Exemplary selectors and selector tables that may be used in the present embodiment will be described in more detail shortly.

B. Exemplary Security Policy Database

TheSPD144 may be a relational database, but alternatively, may include a static random access memory (SRAM), dynamic random access memory (DRAM), buffer, magnetic hard disk drive, optical memory, or any other storage mechanism known in the art. In the present embodiment, theSPD144 may store different IPsec policies mapped to selectors. By providing a specific selector to theSPD144, a matching IPsec policy may be found. The IPsec policy may be subsequently applied to corresponding packets passing through the initiatingsecurity gateway140, as will be described later in an exemplary method.

C. Exemplary QoS Module

In the present embodiment, theQoS module146 may be in communication with theselector module142 and theIPsec module148. TheQoS module146 may also include a QoS table mapping QoS markings to VLAN tags included within the packets. Alternatively, or additionally, the QoS table may map the QoS markings to the selectors determined within theselector module142. Thus, depending on the VLAN tag and/or selector provided to theQoS module146, the QoS table may include a matching set of QoS markings may be provided. TheQoS module146 may then mark packets with matching QoS markings to indicate the desired service parameters of the packet-switched data (e.g., minimum throughput, maximum latency). Different user domains or user sessions may have different QoS parameters and thus, packet switched data for each user domain or session may be marked differently. In the present embodiment, QoS markings may be placed within the Type of Service (ToS) byte field within the IP packet header, though any portion of the packet may be marked in alternate embodiments. Further, the QoS table mapping the QoS markings may alternatively be stored within another component inside the initiating security gateway140 (e.g., the SPD144), and theQoS module146 may communicate with that component in order to obtain the proper QoS markings. For more information on QoS, one can refer to RFC 2386, “A Framework for QoS-based Routing in the Internet”, the contents of which are incorporated in its entirety herein by reference.

D. Exemplary IPsec Module

TheIPsec module148 may be used to initiate an IPsec tunnel between the initiatingsecurity gateway140 and the terminatingsecurity gateway180. Alternatively, or additionally, other tunneling mechanisms (e.g., IP-in-IP, L2TP, PPTP) may be utilized between thegateways140,180, and IPsec may be utilized in a transport mode. Further, theIPsec module148 may add an authentication header (AH) to packets passing through to help ensure the integrity of transmitted data. TheIPsec module148 may also encrypt the packet data and add an encapsulating security payload (ESP) to the header. For more information on IPsec, one can refer to the previously cited RFC 2401.

IV. Exemplary Connection between Gateways within the VPN

FIG. 3 shows exemplary connections between the initiatingsecurity gateway140 and terminatingsecurity gateways180a,180bwithin the receivingnetwork170. It should be understood that the terminatingsecurity gateways180a,180bare preferably substantially similar to the previously described terminatingsecurity gateway180. As shown inFIG. 3, packets containing VLAN tags of “1”, “2” and “3” may be forwarded from the initiatingsecurity gateway140 to the terminatingsecurity gateway180aalong connections “1”. “2”, and “3a”, respectively. Similarly, packets containing VLAN tags of “3” or “4” may be forwarded from the initiatingsecurity gateway140 to the terminatingsecurity gateway180balong connections “3b” and “4”, respectively. Although shown as separate connections, the connections “1”–“3a” and “3b”–“4” may share the same physical transmission lines. Further, it should be noted that a packet having a single VLAN tag (e.g., “3”) may be mapped to more than one terminatingsecurity gateway180a,180bwithin thesame receiving network170.

Using the present VPN configuration, differentiated QoS and/or IPsec procedures may be applied to packets having different VLAN tags. In an exemplary scenario, VLAN tags “1” and “4” may correspond to a basic level of QoS and/or IPsec service, VLAN tag “2” may correspond to an intermediate level of QoS and/or IPsec service, and VLAN tag “3” may correspond to a premium level of QoS and/or IPsec service. In the present scenario, each of the VLAN tags “1”–“4” directs a corresponding packet to thesame receiving network170. However, the actual VLAN tag assigned to a user session may affect the level of QoS and IPsec protection for the user session.

Additionally, the present configuration may enable load balancing of data traffic within theVPN100. For example, at a given time, user sessions utilizing VLAN tag “1” may be transmitting an especially high number of packets. At the same time, user sessions utilizing VLAN tag “4” may be transmitting a very low number of packets, possibly due to the termination of an abnormally large number of user sessions that utilize VLAN tag “4”. If the QoS and IPsec levels are the same for user sessions associated with VLAN tags “1” and “4”, theaccess server150 or other network component may intelligently assign new user sessions to VLAN tag “4” (corresponding to terminatingsecurity gateway180b) in order to load balance the data traffic and prevent an overload on terminatingsecurity gateway180a.

V. Exemplary Intermediate Components within the VPN

Turning now toFIG. 4, another exemplary embodiment of theVPN100 is shown having exemplary intermediate components. In the present embodiment, thehome agent130 may be in communication with a routing device302 (e.g., switch or router). Therouting device302 may be further in communication with initiatingsecurity gateways140a–d,which may be in communication with the terminatingsecurity gateways180a,180bwithin the receivingnetworks170a,170b,respectively. It should be understood that the initiatingsecurity gateways140a–d,receivingnetworks170a–b,and terminatingsecurity gateways180a–bare preferably substantially the same as the previously described initiatingsecurity gateway140, receivingnetwork170, and terminatingsecurity gateway180, respectively. Furthermore, the initiatingsecurity gateways140a–dmay communicate with one another and/or other elements within theVPN100 to facilitate load balancing. Also, the terminatinggateways180a–bmay have IP addresses of “149.112.213.100” and “168.114.200.104”, respectively, though any other type of address may alternatively be used. It should be further understood that any number of these or other components may be utilized in alternate embodiments. For example, additional switch(es) and compression server(s) may alternatively be utilized between thehome agent130 and therouting device302.

In the present embodiment, therouting device302 may forward packets from thehome agent130 to the initiatingsecurity gateways140a–ddepending on the VLAN tags contained within the packet. For example, if a packet has a VLAN tag of1, therouting device302 may route the packet to the initiatingsecurity gateway140a.Alternatively, if the packet has a VLAN tag of either a3 or a5, the packet may be forwarded to initiatingsecurity gateway140c.It should be evident that any number and combination of forwarding scenarios may be used in the present embodiment.

Once a packet reaches one of the initiatingsecurity gateways140a–140d,it may be copied and/or forwarded to one or more of the terminatingsecurity gateways180a–b.Preferably, an IP-in-IP tunnel or IPsec tunnel is created at this stage in order to transport the packet. After the packet reaches one or more of the receivingnetworks170a–b,it may be forwarded to its appropriate destination (e.g., as specified by its destination IP address). An exemplary method of sending a packet from a user device to a receiving network will be described shortly.

Similar to the previous exemplary embodiment, theaccess server150 may assign VLAN tags to new user sessions in order to create differentiated QoS and/or IPsec services. Also, VLAN tags may also be intelligently assigned to enable load balancing of data traffic among the initiatingsecurity gateways140a–dand terminatingsecurity gateways180a–b.

VI. Exemplary Network Domains within VPN

Turning now toFIG. 5, an exemplary embodiment of theVPN100 is shown with a number ofnetwork domains172a–cforming part of the receivingnetwork170. In the present embodiment, packets including VLAN tags “1”–“5” may be received by the initiatingsecurity gateway140. Although shown as separate connections, the connections “1”–“3a” and “3b”–“4” may share the same physical transmission lines. These VLAN tags may be mapped to network domain names (e.g., “@mozart.music.3com.com”, “@beethoven.music.3com.com”, “@chopin.music.3com.com”) within the selector table. For example, packets including a VLAN tag of “5” may be forwarded to the network domain “@chopin.music.3com.com”, and packets including a VLAN tag of “3” may be copied and/or forwarded to network domains “@mozart.music.3com.com”, and “@beethoven.music.3com.com”. It should be understood that any number and type of network domains and domain names may be used with the present embodiment.

The network domain names may be used as selectors into theSPD144 for finding a corresponding IPsec policy and/or a corresponding TSGA. For example, if the domain name “@mozart.music.3com.com” is used as a selector to theSPD144, a corresponding IPsec policy and address of the corresponding terminatingsecurity gateway180amay be found. It should be understood that any number of terminating security gateways and network domains may map to one another. Additionally, theQoS module146 may use the network domain name, VLAN tag, and/or QoS table to find QoS markings for the packet. Further, theIPsec module148 may create a tunnel (e.g., IPsec tunnel) from the initiatingsecurity gateway140 to the terminatingsecurity gateway180a, and the packet may then be forwarded to the proper destination depending on the original destination address of the packet.

VII. Exemplary Selector Table and Selectors

FIG. 6 shows an exemplary selector table600 mapping VLAN tags610 to terminating security gateway addresses (TSGAs)620 for the terminatingsecurity gateways180a–binFIG. 4. In the present embodiment, theTSGAs620 may be used as selectors to theSPD144, though a number of other types of selectors may also be used, such as a source or destination IP address (e.g., IP version 4 (IPv4) or IP version 6 (IPv6)), user identification (e.g., a fully qualified user name string or X.500 distinguished name), system name (e.g., host or security gateway name), data sensitivity level (e.g., IP Security Option (IPSO)/Commercial IPSO (CIPSO) labels), transport layer protocol (e.g., obtained from the IPv4 “Protocol” or IPv6 “Next Header” fields), and source and destination (e.g., TCP or UDP) ports. As shown in the selector table600, multiple VLAN tags may map to the same TSGA (e.g.,entries632,634,636 andentries638,640,642), and one VLAN tag may map to multiple TSGAs (e.g.,entries636,638). Further, a VLAN tag and a TSGA may uniquely map to one another.

Corresponding to the exemplary embodiment shown inFIG. 4, each of the initiatingsecurity gateways140a–dmay include the entire selector table600. Alternatively, each initiatingsecurity gateway140a–dmay store a portion of the selector table600 relevant to the VLAN tag(s) associated with that initiatingsecurity gateway140a–d.For example, the initiatingsecurity gateway140amay storeentry632 corresponding to VLAN tag “1”, and the initiatingsecurity gateway140cmay storeentries636,638, and642, corresponding to VLAN tags “3” and “5”.

Although the TSGAs may use IP addresses in the present embodiment, other types of addressing (e.g., Media Access Control (MAC)) may also be utilized. Furthermore, it should be noted that within the current IPsec protocol, VLAN tags are not usable as selectors. Thus, the present embodiment may be used to provide a method of differentiating IPsec policy by using VLAN tags.

VII. Exemplary Method of Packet Transmission

FIG. 7 shows anexemplary method700 of transmitting data within theVPN100 using the selector table600 and the exemplary configuration shown inFIG. 4. Although thepresent method700 describes a user session “A” for theuser device102, it should be understood that themethod700 may alternatively be applied to any number and type of user sessions and devices, with any number of different configurations for theVPN100.

In thepresent method700, theuser device102 may already have established an SA and a user session “A” with the terminatingsecurity gateway180awithin the receivingnetwork170a.Theuser device102 may also already be authenticated and authorized by theaccess server150 to access thereceiving network170a.Further, theaccess server150 may have already provided a VLAN tag (e.g., VLAN tag “1”) for the user session “A”.

In thefirst step702, theuser device102 may send a packet to thehome agent130 during the user session “A”. Thehome agent130 may include the VLAN tag in the packet and forward the packet to theselector module142 within the initiatingsecurity gateway140a.Theselector module142 may utilize the selecting mechanism (e.g., filter) for recognizing and obtaining the VLAN tag value within the packet.

In thefollowing step704, the VLAN tag may be mapped to one or more of theTSGAs620 within the selection table600. In the present embodiment, the VLAN tag may correspond to a TSGA that is the address of the terminatingsecurity gateway180a.This TSGA may then be used as a selector within theSPD144.

Additionally, instep706, theselection module142 may perform IP-in-IP tunneling on the packet. Thus, theselection module142 may add a destination address to the packet header that corresponds to the address of the terminatingsecurity gateway180a.Theselection module142 may also add a source address to the packet header that corresponds to the address of the initiatingsecurity gateway140a.

Instep708, the packet may be forwarded to theQoS module146, where the packet may be marked by QoS markings. TheQoS module146 may add the QoS markings to the ToS byte or other field within the packet. Furthermore, the QoS markings for the packet may be determined by querying the QoS table with the selector (e.g., TSGA) and/or VLAN tag.

In thefollowing step710, the packet may be forwarded to theIPsec module148, which may initiate IPsec procedures on the packet. TheIPsec module148 may use the address of the terminatingsecurity gateway180aas a selector within theSPD144 in order to extract a corresponding IPsec policy. TheIPsec module148 may then apply the IPsec policy to the packet, which may include adding an authentication header and/or encapsulated security payload to the packet header. The IPsec policy may also specify additional tunneling mechanisms (e.g., IPsec tunnel) to be implemented on top of the IP-in-IP tunnel.

Instep712, the packet may be transmitted from the initiatingsecurity gateway140ato the terminatingsecurity gateway180aacross the IP-in-IP tunnel. In thefollowing step714, the terminatingsecurity gateway180amay perform a reverse IPsec procedure, which may include decapsulating the tunneled packet, decrypting the packet, checking the authentication header to help ensure the integrity of the packet data, and comparing the selector within the packet to selectors within the locally stored SPD.

Instep716, the packet may then be forwarded to its final destination, as specified by the packet's original destination address. The final destination may be located internal or external to thenetwork170a.

For packets sent from the terminatingsecurity gateway180ato theuser device102 utilizing the user session “A”, the terminatingsecurity gateway180amay perform IPsec procedures on the packets and create a tunnel (e.g., IP-in-IP or IPsec tunnel) to the initiatingsecurity gateway140a.A reverse IPsec procedure may then be performed within the initiatingsecurity gateway140a,and the packet may be forwarded to theuser device102.

IX. Another Exemplary Selector Table

Turning now toFIG. 8, a second selector table800 is shown havingVLAN tags810 corresponding todomain names820. The selector table800 may be substantially similar to the table600 except that theTSGAs620 have been replaced withdomain names820 corresponding to thenetwork domains172a–cas shown inFIG. 5. For example, as shown inentry832, a VLAN tag of “1” may correspond to thenetwork domain172athat has the domain name “@mozart.music.3com.com”.

Additionally, thedomain names820 may be used as selectors within theSPD144. It should be understood that thedomain names820, as well as theTSGAs620, are merely exemplary, and that any type or number of such selectors may be utilized with the present embodiment.

X. Exemplary Selector Table Configuration

A network administrator may statically configure a selector table (e.g., selector tables600,800) within the initiatingsecurity gateway140 to match the table within thestorage unit160 used for assigning VLAN tags. Alternatively, a selector table may be dynamically configured and matched to the table within thestorage unit160. In a dynamic configuration scheme, a change in the table within thestorage unit160 may trigger the same change within the selector table. Such a change may be communicated between thestorage unit160 and the initiatingsecurity gateway140 using any type of communication medium (e.g., Ethernet, wireless communications, etc.). A dynamic configuration scheme may be advantageous, since a change in the storage unit table (e.g., caused by a change in network configuration) may automatically cause a change within a selector table (e.g., selector tables600 or800), thus reducing the need for manual reconfiguration of the selector table.

XI. Another Exemplary Method of Packet Transmission

FIG. 9 shows anotherexemplary method900 of transmitting data within theVPN100 using the selector table800 and the exemplary configuration shown inFIG. 5. Thepresent method900 is preferably substantially similar to the previously describedmethod700 except that thedomain names820 may be used as selectors within theSPD144 instead of theTSGAs620. Furthermore, although thepresent method900 describes a user session “A” for theuser device102, it should be understood that themethod900 may alternatively be applied to any number and type of user sessions and devices, with any number of different configurations for theVPN100.

In thepresent method900, theuser device102 may already have established an SA and a user session “A” with the terminatingsecurity gateway180awithin the receivingnetwork170a.Theuser device102 may also already be authenticated and authorized by theaccess server150 to access thereceiving network170a.Further, theaccess server150 may have already provided a VLAN tag (e.g., VLAN tag “1”) for the user session “A”.

In thefirst step902, theuser device102 may send a packet to thehome agent130 during the user session “A”. Furthermore, thehome agent130 may add to the packet a VLAN tag (e.g., “1”) that is assigned to the user session “A”. Thehome agent130 may then forward the packet to theselector module142 within the initiatingsecurity gateway140. Theselector module142 may utilize the selecting mechanism (e.g., filter) for recognizing and extracting the VLAN tag within the packet.

In thefollowing step904, the VLAN tag may be mapped to one or more of thedomain names820 within the selection table800. As shown inFIG. 8, the VLAN tag “1” may correspond to the domain name “@mozart.music.3com.com”. Instep906, this domain name may be used as a selector within theSPD144.

Instep908, the packet may be forwarded to theQoS module146, where the packet may be marked by QoS markings. TheQoS module146 may add the QoS markings to the ToS byte or other field within the packet. Furthermore, the QoS markings for the packet may be determined by querying the QoS table with the selector (e.g., domain name) and/or VLAN tag.

In thefollowing step910, the packet may be forwarded to theIPsec module148, which may initiate IPsec-procedures on the packet. TheIPsec module148 may use the domain names (e.g., “@mozart.music.3com.com”) as a selector within theSPD144 in order to extract a corresponding IPsec policy. TheIPsec module148 may then apply the IPsec policy to the packet, which may include adding an authentication header and/or encapsulated security payload to the packet header. Furthermore, theIPsec module148 may initiate an IPsec tunnel between the initiatingsecurity gateway140 and the terminatingsecurity gateway180ain order to forward the packet to thenetwork domain172a(having the domain name “@mozart.music.3com.com”).

Instep912, the packet may be transmitted from the initiatingsecurity gateway140 to the terminatingsecurity gateway180aacross the IPsec tunnel. In thefollowing step914, the terminatingsecurity gateway180amay perform a reverse IPsec procedure, which may include decapsulating the tunneled packet, decrypting the packet, checking the authentication header to help ensure the integrity of the packet data, and comparing the selector within the packet to selectors within the locally stored SPD.

Instep916, the packet may then be forwarded to its final destination, as specified by the packet's original destination address. The final destination may be located internal or external to thereceiving network170.

For packets sent from the terminatingsecurity gateway180ato theuser device102 utilizing the user session “A”, IPsec procedures may be performed by the terminatingsecurity gateway180a,and a tunnel (e.g., IP-in-IP or IPsec tunnel) may be created to the initiatingsecurity gateway140. A reverse IPsec procedure may then be performed within the initiatingsecurity gateway140, and the packet may be forwarded to theuser device102.

The present embodiments may provide a number of advantages. First, by utilizing VLAN tags for identifying user domains or user sessions, differentiated tunneling and/or Quality of Service capabilities may be specified by the user for each of these sessions. Additionally, the use of VLAN tags may enable a flexible network topology that is easily scalable as the number of user devices changes. Furthermore, by mapping VLAN tags to user sessions, the present embodiments may allow a convenient and organized way of assigning priorities to different user domains or user sessions. Additionally, the present embodiments may enable load balancing of packet switched-data through a VPN though the use of VLAN tags.

It should be understood that a wide variety of additions and modifications may be made to the exemplary embodiments described within the present application. For example, more or fewer components (e.g., switches) may be utilized with theVPN100 depending on its desired functionality. Further, in an alternate embodiment, thehome agent130 and the initiatingsecurity gateway140 may be stored within the same housing and be part of a single hardware component, and the single hardware component may also perform compression/decompression procedures. It is therefore intended that the foregoing description illustrates rather than limits this invention and that it is the following claims, including all of the equivalents, which define this invention:

Claims (32)

1. A network access system comprising:

a home agent in communication with a user device via a user session;

an initiating security gateway in communication with the home agent; and

a terminating security gateway in communication with the initiating security gateway via a tunnel,

wherein a virtual local area network tag associated with the user session maps to a selector operable in a security policy database associated with an Internet Protocol Security protocol, and wherein the selector maps to a security policy stored within the security policy database.

2. The network access system ofclaim 1 further comprising an access server that authenticates the user device and provides the virtual local area network tag to the home agent.

3. The network access system ofclaim 1, wherein the security policy defines an Internet Protocol security procedure.

4. The network access system ofclaim 3, wherein the selector maps to the Internet Protocol security procedure, and the Internet Protocol security procedure is applied to the tunnel.

5. The network access system ofclaim 1, wherein the initiating security gateway further comprises a Quality of Service module that determines a Quality of Service marking for a packet that is sent along the tunnel.

6. The network access system ofclaim 1, wherein at least a portion of the network access system is a virtual private network.

7. The network access system ofclaim 1, wherein the user session passes between the user device and the home agent via a foreign agent.

8. The network access system ofclaim 1, wherein the terminating security gateway is part of a local area network.

9. The network access system ofclaim 1, wherein the selector includes at least one of an address and domain name associated with the network access system.

10. The network access system ofclaim 1, wherein the tunnel comprises at least one of an Internet Protocol security tunnel and an Internet Protocol in Internet Protocol tunnel.

11. A method for transmitting a packet via an initiating security gateway, the method comprising the steps of:

receiving a packet including a virtual local area network tag associated with a user session;

mapping the virtual local area network tag to a selector;

mapping the selector to a security policy stored within a security policy database associated with an Internet Protocol Security protocol;

performing an Internet Protocol security procedure based on the security policy; and

transmitting the packet to a terminating security gateway across a tunnel.

12. The method ofclaim 11 further comprising marking the packet with a Quality of Service marking.

13. The method ofclaim 11, wherein performing an Internet Protocol security procedure comprises adding at least one of an authentication header and encapsulated security payload to the packet.

14. The method ofclaim 11, wherein performing an Internet Protocol security procedure comprises creating an Internet Protocol security tunnel.

15. The method ofclaim 11, wherein the selector is an address of the terminating security gateway.

16. The method ofclaim 15 further comprising creating an Internet Protocol in Internet Protocol tunnel utilizing the address of the terminating security gateway as a destination address.

17. The method ofclaim 11, wherein the selector is a domain name associated with the terminating security gateway.

18. The method ofclaim 11 further comprising performing a reverse Internet Protocol security procedure at the terminating gateway to obtain data stored within the packet.

19. The method ofclaim 11 further comprising a computer readable medium having stored therein instructions for causing a processor to execute the steps of the method ofclaim 11.

20. A network system comprising:

a home agent in communication with a user device via a user session;

an access server that authenticates the user device and provides a virtual local area network tag for the user session to the home agent;

an initiating security gateway that receives a packet including the virtual local area network tag from the home agent, wherein the initiating security gateway includes a selector table mapping the virtual local area network tag to a selector;

a security policy database that is associated with a Internet Protocol Security protocol, wherein the security policy database maps the selector to at least one security policy defining an Internet Protocol security procedure, wherein the Internet Protocol security procedure is applied to the packet; and

a receiving network including a terminating security gateway that receives the packet from the initiating security gateway via a tunnel.

21. The network system ofclaim 20, wherein the initiating security gateway further comprises a Quality of Service module that determines a Quality of Service marking for the packet.

22. The network system ofclaim 20, wherein the initiating security gateway further comprises an Internet Protocol security module for creating at least one of an authentication header and encapsulating security payload for the packet.

23. The network system ofclaim 20, wherein the access server stores a user profile for the user device that maps the virtual local area network tag to a network domain.

24. The network system ofclaim 20, wherein the user device receives the virtual local area network tag from the access server and stores the information in a mobility binding record.

25. The network system ofclaim 20, wherein the initiating security gateway receives and recognizes Ethernet frames that have virtual local area network tags.

26. The network system ofclaim 20, wherein the tunnel comprises at least one of an Internet Protocol in Internet Protocol tunnel and an Internet Protocol security tunnel.

27. The network system ofclaim 20, wherein at least a portion of the network system is a virtual private network.

28. An initiating security gateway comprising:

a selector module including a filtering mechanism for identifying a virtual local area network tag associated with a user session within a packet and a selector table for mapping the virtual local area network tag to a selector;

a security policy database associated with an Internet Protocol Security protocol for mapping the selector to an Internet Protocol security policy; and

an Internet Protocol Security module for applying the Internet Protocol security policy to the packet while sending the packet to a terminating security gateway.

29. The initiating security gateway ofclaim 28 further comprising a Quality of Service module that includes a Quality of Service table, wherein at least one of the virtual local area network tag and the selector maps to a Quality of Service marking within the Quality of Service table.

30. The initiating security gateway ofclaim 29, wherein the Quality of Service module marks the packet with the Quality of Service marking before sending the packet to the terminating security gateway.

31. The initiating security gateway ofclaim 28, wherein the Internet Protocol security module creates an Internet Protocol security tunnel for sending the packet to the terminating security gateway.

32. The initiating security gateway ofclaim 28, wherein the Internet Protocol security module adds at least one of an authentication header and an encapsulated security payload to the packet before sending the packet to the terminating security gateway.

Images